Linux Kernel Vulnerability in IPv4 Route Notifications

CVE-2026-99072

What is CVE-2026-99072?

A risk exists within the Linux kernel's IPv4 routing functionality, related to the handling of route notifications. When nexthop groups are modified to include fewer paths, a flaw in the processing logic can result in null dereferences, leading to potential instability or crashes within network processes. This vulnerability highlights a failure to properly handle updates in route notification sizing, which can compromise the integrity of network operations and system stability.

References